Automated synchronized domain wide transient policy

• US 9,705,921 B2
• Filed: 04/16/2014
• Issued: 07/11/2017
• Est. Priority Date: 04/16/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Voit, Eric A.
• Primary Examiner(s): Rashid, Harunur
• Assistant Examiner(s): Huang, Cheng-Feng
• Application Number:
  US14/254,492
• Publication Number:
  US 20150304355A1
• Time in Patent Office: 1,182 Days
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are provided for, at an administrative device in a network domain, monitoring a network traffic flow parameter to determine whether a presently applied domain wide policy configured to control a network traffic flow should be removed. In response to determining that the domain wide policy should be removed, a command is generated which causes removal of the domain wide policy at each one of the plurality of network devices, and the command is sent to each one of the plurality of network devices to cause the domain wide policy to be removed at substantially the same time at each network device. Alternatively, the domain wide policy can be automatically removed by the expiry of a timer or in accordance with a timestamp so that the policy is revoked across the network domain without a need for an explicit network wide control message instructing removal of the policy.

Claims

1. A method comprising:

at a plurality of network switching and routing devices in a network domain, receiving a domain wide policy configured to control a flow of network traffic through each of the plurality of network switching and routing devices;

implementing the domain wide policy; and

removing the domain wide policy, in accordance with one or more parameters specifying that the domain wide policy is to be removed, such that the domain wide policy is removed in a synchronized manner, based on a domain clock, from each one of the network switching and routing devices in the plurality of network switching and routing devices in the network domain,

wherein the domain wide policy is removed by placing the domain wide policy in an idle state on each one of the plurality of network switching and routing devices in the network domain and wherein the domain wide policy is reengaged upon request,

wherein the one or more parameters comprises an indicator stored at a location to which a pointer stored on specific ones of the network switching and routing devices point, such that when an indication in the location indicates removal of the domain wide policy on the administrative device, removal of the domain wide policy at each device of the plurality of network switching and routing devices is automatically triggered.

2. The method of claim 1, wherein at least one of the one or more parameters is a timing parameter specifying an end timestamp indicating how long the domain wide policy is to remain in effect, and removing the domain wide policy upon determining that a time specified by the end timestamp has been exceeded.

3. The method of claim 1, further comprising monitoring the indicator at an interval specified by a timer, a timestamp, or according to instructions received from an administrative device.

4. The method of claim 1, wherein deleting comprises deleting the domain wide policy in accordance with another parameter, wherein the another parameter comprises a command received from a network administrative device that instructs deletion of the domain wide policy.

5. The method of claim 1, wherein deleting the domain wide policy is performed independently from an administrative device.

6. A system comprising:

a plurality of network switching and routing devices in a network domain, wherein each network device comprises;

a network interface unit configured to send and receive communications over a network;

memory configured to store one or more network policies or parameters associated with network traffic flow; and

one or more processors coupled to the network interface unit, and configured to;

receive a domain wide policy configured to control a flow of network traffic through each of the plurality of network switching and routing devices at a plurality of network switching and routing devices in a network domain;

implement the domain wide policy; and

remove the domain wide policy, in accordance with one or more parameters specifying that the domain wide policy is to be removed, such that the domain wide policy is removed in a synchronized manner, based on a domain clock, from each one of the network switching and routing devices in the plurality of network switching and routing devices in the network domain,

wherein the domain wide policy is removed by placing the domain wide policy in an idle state on each one of the plurality of network switching and routing devices in the network domain and wherein the domain wide policy is reengaged upon request, and

wherein the one or more parameters comprises an indicator stored at a location to which a pointer stored on the plurality of network switching and routing devices point, and wherein the processor is configured to remove the domain wide policy at each device of the plurality of network switching and routing devices automatically, when an indication in the location indicates removal of the domain wide policy on the administrative device.

7. The system of claim 6, wherein at least one of the one or more parameters is a timing parameter specifying an end timestamp indicating how long the domain wide policy is to remain in effect, and wherein the processor is configured to remove the domain wide policy upon determining that time specified by the end timestamp has been exceeded.

8. The system of claim 6, wherein the processor is configured to monitor the indicator at an interval specified by a timer, a timestamp, or according to instructions received from an administrative device.

9. The system of claim 6, wherein the processor is configured to delete the domain wide policy in accordance with another parameter, wherein the another parameter comprises a command received from a network administrative device that instructs deletion of the domain wide policy.

10. The system of claim 6, wherein the processor is configured to delete the domain wide policy independently from an administrative device.